Best way to escape strings for sql inserts?

Question

What is the best way to escape strings for sql inserts, updates?

I want to allow special characters including ' and ". Is the best way to search and replace each string before I use it in an insert statement?

Thanks

Duplicate of: Best way to defend against mysql injection and cross site scripting

Why do you need to do any parsing? Doesn't mysql permit parameterized queries? — John Saunders, Mar 11 '09 at 02:26
By 'parse', do you mean to say 'escape', that is, neutralize metacharacters so that data can be safely embedded in a query? — chaos, Mar 11 '09 at 02:29

score 5 · Accepted Answer · answered Mar 11 '09 at 02:42

5

You should be using parameterized queries (so by extension, a DB interface library that supports parameterized queries) so that SQL injection can't happen.

answered Mar 11 '09 at 02:42

nobody

19,814
17
56
77

score 4 · Answer 2 · answered Mar 11 '09 at 02:26

If you're talking about data values for your fields, then the best way is to use mysql_real_escape_string(). (Some people like mysqli; can't say I do.) If you're talking about allowing user-submitted queries... well, let's hope you're not talking about that.

Best way to escape strings for sql inserts?

2 Answers2

Linked